This policy explains what information Forebytes collects when you use the app, why, and what rights you have over it. Forebytes is built for a European user base and is designed around the EU General Data Protection Regulation (GDPR) from the ground up, not retrofitted onto it: our database is hosted in the EU, and account deletion genuinely erases your data rather than just hiding it.
Who is responsible for your data
[FOREBYTES ENTITY NAME], [REGISTERED ADDRESS] ("Forebytes", "we", "us") is the data controller for the personal data described in this policy.
Questions about your data, or this policy: support@forebytes.com
What we collect, and why
Account information
Email address, username, and a hashed password (we never see or store your password in plain text), collected when you sign up. If you sign in with Apple or Google instead, we receive only the minimum identifier and email those services pass us. We never see your Apple or Google password.
Why: to create and secure your account, and to let you sign back in.
Profile information
Display name, username, an optional avatar photo, and whether your account is private or public.
Why: so other users can recognise and (if you allow it) follow you.
Location
Your device's location, while you have the discover map open.
Why: to show you restaurants near you. This is used live to query nearby places; it is not stored or retained once your session ends.
Content you create
Restaurant and dish ratings, written reviews, lists of places you've saved or want to try, restaurants and dishes you contribute, and photos you submit of dishes.
Why: this is the substance of the app, it's what you're here to do, and it's what other users see when they look up a restaurant or dish.
Social connections
Who you follow, who follows you, and (if your account is private) pending follow requests.
Why: to build your feed and control who sees your activity.
Device and notification data
A device token used to deliver push notifications, and your notification preferences (which kinds of notifications you want).
Why: so we can tell you about things like a new follower or an approved dish submission, if you've chosen to receive them. You can turn notifications off entirely in Settings.
Analytics
We use PostHog to understand how people use the app: which screens get opened, which features get used, and what fails. These events are tied to your account id, never to your email address, display name, written reviews, or anything you've typed into a search box.
Why: to find out what's broken and what isn't used, so we can fix and improve the app.
Error reports
We use Sentry to catch crashes and bugs, including some technical context (like which screen and what operation) to help us fix them.
Why: so problems get found and fixed, ideally before you notice them twice.
Who we share it with
We don't sell your data, to anyone, ever. We do use a small number of other companies to actually run the service, each only for what they need:
- Supabase: our database, authentication and file storage, hosted in the EU. This holds the bulk of your account and content data.
- Mapbox: provides the map and restaurant search results.
- Google (Places API): fills in restaurant photos that Mapbox doesn't provide.
- PostHog: product analytics, EU-hosted.
- Sentry: error and crash reporting, EU-hosted.
- Brevo: sends transactional emails (sign-up confirmation, password reset, security notices). We do not use this for marketing emails.
Supabase, PostHog, Sentry, and Brevo are all EU-hosted or EU-based companies. Mapbox and Google (for restaurant photos) are US companies; where their processing involves data leaving the EU, this is covered by standard contractual clauses, the standard legal mechanism for that kind of transfer.
We may also disclose information if required by law, or to protect the safety of our users.
How long we keep it
We keep your account data for as long as your account exists. If you delete your account (Settings > Delete Account), this is a genuine deletion, not a flag: your profile, ratings, reviews, and personal data are removed from our database, not merely hidden.
One exception, by design: if you contributed a restaurant, a dish, a menu item, or a photo, that content stays on the platform after your account is deleted, with your name disconnected from it. Those contributions describe real restaurants that exist independently of you, and other people's reviews and the app's own data depend on them still being there. Your personal connection to that contribution is removed; the contribution itself is not.
Your rights
Under GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data (you can do most of this yourself, in Profile > Edit)
- Erase your data (Settings > Delete Account, which is a real, immediate erasure)
- Port your data to another service
- Object to or restrict certain processing
- Withdraw consent, where we rely on it
Access and portability requests are currently handled manually: email support@forebytes.com and we'll get you what you're asking for. There isn't yet a self-serve "export my data" button in the app itself.
To exercise any of these rights, email support@forebytes.com. We'll respond within the timeframe GDPR requires (generally one month).
You also have the right to lodge a complaint with your local data protection authority. In Ireland this is the Data Protection Commission (www.dataprotection.ie).
Children
Forebytes is not intended for anyone under 16. We don't knowingly collect data from children under this age.
Security
Your data is protected by access controls at the database level (every table enforces row-level security, meaning even a bug in our own code can't expose one user's private data to another by accident), and data in transit is encrypted. No system is perfectly secure, but this is designed in from the start, not bolted on.
Changes to this policy
We'll update the date at the top of this page if this policy changes, and notify you in-app for any change that meaningfully affects your rights.